# Cloudflare setup for PopMCP

One Cloudflare API token, prefixed cfut_ and shown once, scoped to the accounts, zones and permissions PopMCP should manage.

- Auth: API credentials
- Setup time: 5 min
- API base URL: https://api.cloudflare.com/client/v4
- Credentials screen: https://dash.cloudflare.com/profile/api-tokens
- Provider docs: https://developers.cloudflare.com/fundamentals/api/get-started/create-token/

## Before you begin

- Cloudflare account on any plan, including Free
- Super Administrator, or a role that includes API token creation, if you want an account-owned token
- Know which zones PopMCP should touch, because token resources are fixed at creation time

## Get your credentials

### 1. Open the API Tokens page

Sign in at `dash.cloudflare.com`, click the user icon at the top right and choose My Profile, then API Tokens. For a token that should outlive your own account, go to Manage Account → API Tokens instead.

Screen: https://dash.cloudflare.com/profile/api-tokens

### 2. Pick a template or start a custom token

Click Create Token, then pick a template such as Edit zone DNS, or scroll to Create Custom Token and click Get started.

### 3. Set the permissions and the resources they apply to

Name the token `PopMCP` and add one permission row per group, choosing Account, User or Zone and then Edit or Read. Restrict Account Resources and Zone Resources to the accounts and domains PopMCP should manage.

### 4. Review the summary and create the token

Check the permission list on the summary screen, then click Create Token. Click Edit token first if a zone or permission is wrong.

### 5. Copy the token value

Copy the `cfut_` value from the success screen and paste it into PopMCP's API token field.

## Fields PopMCP asks for

- API token (apiToken) [required]: In Cloudflare: My Profile → API Tokens → Create Token. Pick a template (e.g. "Edit zone DNS") or a custom token scoped to the accounts/zones and permissions you need. Copy the token (shown once) and paste it here. Account-owned tokens (Manage Account → API Tokens) also work. Stored encrypted.

## Verify

PopMCP shows the connector as Connected and lists your zones, and the token returns "This API Token is valid and active" from /user/tokens/verify.

## Troubleshooting

### 10000 Authentication error

Cause: The token was pasted with the word Bearer, surrounding quotes or a trailing newline.

Fix: Paste only the raw cfut_ value with no whitespace.

### 9109 Unauthorized to access requested resource

Cause: The permission exists but the zone or account was not included under Zone Resources.

Fix: Edit the token and add the zone, or switch Zone Resources to All zones from an account.

### Tools can read but every write fails

Cause: The permission row was set to Read rather than Edit.

Fix: Edit the token, change the level to Edit and save.

### The token worked, then stopped

Cause: A TTL end date was set, or Client IP Address Filtering excludes PopMCP's egress addresses.

Fix: Remove the TTL and the IP filter, or create a replacement token without them.

### You closed the success screen before copying

Cause: Cloudflare shows the token secret once.

Fix: Open the token from the API Tokens list, choose Roll, and copy the new value.

### 429 Too Many Requests

Cause: Cloudflare caps API traffic at 1,200 requests per five minutes per user, and dashboard activity counts toward it.

Fix: Wait five minutes and batch the work.

---

Source: https://www.docs.popmcp.com/docs/integrations/cloudflare/